Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe
-
Size
454KB
-
MD5
3f9db2758417d115184a015cf636bfb0
-
SHA1
3748df36dc4ed5695609e5bd13c8ccb7ac26968a
-
SHA256
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cb
-
SHA512
0aae71b06b9fe2db48441fd7a7366973928b63fce86f53d918ebdfff0d23b238ce353ccaa7a4dcd9a168ae8d7af4e65dd26c9b3d89ec6ab00c89f38139f6da2d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1G:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4804-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-1303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-1424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2248 hhnnnn.exe 1468 hbnbth.exe 4344 lfrrlfx.exe 888 hhbtbb.exe 3332 jjppp.exe 3488 lfrxlfl.exe 2584 thnbbh.exe 920 rlllffl.exe 4268 xrxrrff.exe 1780 pdppp.exe 3212 frrrxlr.exe 4152 jvppp.exe 2492 rfllrrr.exe 4176 httnhh.exe 4604 bbnbbn.exe 4032 ffrxlfx.exe 3228 ntbnth.exe 1188 pjvvv.exe 3380 flfxrff.exe 3048 jdvjj.exe 2716 pvvjv.exe 4040 rrxxxlr.exe 5000 tttnnn.exe 2648 llfrlfx.exe 4960 pvdvp.exe 648 jddvp.exe 5064 xflllfl.exe 2220 vppjd.exe 3784 rlrrrlf.exe 1112 1hnhbt.exe 2076 xfrxflf.exe 1476 vvvpp.exe 4244 dpppp.exe 1008 xfffffl.exe 4808 nnbbtb.exe 4680 rrrxlff.exe 3644 nnnnnn.exe 2536 vjdvj.exe 3536 xxxlllf.exe 3840 rrrllll.exe 3188 thtnnn.exe 3804 ddvdd.exe 3500 xflfffx.exe 4028 htbttn.exe 3724 7vjdp.exe 2524 rllffff.exe 3296 hhnhnt.exe 1484 ttnntn.exe 632 lfffxfx.exe 4528 bnttnn.exe 4532 pjjdj.exe 4804 bnbtnn.exe 4556 pjvpv.exe 3708 vjpjd.exe 2136 lfrlxxx.exe 4272 ntttnt.exe 3060 dpvpp.exe 4876 llrxlxr.exe 3396 thnnnn.exe 2688 pdpjd.exe 3488 pjjdv.exe 1156 fxrlffl.exe 4136 5bhbbb.exe 936 pddvv.exe -
resource yara_rule behavioral2/memory/4804-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-766-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2248 4804 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 82 PID 4804 wrote to memory of 2248 4804 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 82 PID 4804 wrote to memory of 2248 4804 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 82 PID 2248 wrote to memory of 1468 2248 hhnnnn.exe 83 PID 2248 wrote to memory of 1468 2248 hhnnnn.exe 83 PID 2248 wrote to memory of 1468 2248 hhnnnn.exe 83 PID 1468 wrote to memory of 4344 1468 hbnbth.exe 84 PID 1468 wrote to memory of 4344 1468 hbnbth.exe 84 PID 1468 wrote to memory of 4344 1468 hbnbth.exe 84 PID 4344 wrote to memory of 888 4344 lfrrlfx.exe 85 PID 4344 wrote to memory of 888 4344 lfrrlfx.exe 85 PID 4344 wrote to memory of 888 4344 lfrrlfx.exe 85 PID 888 wrote to memory of 3332 888 hhbtbb.exe 86 PID 888 wrote to memory of 3332 888 hhbtbb.exe 86 PID 888 wrote to memory of 3332 888 hhbtbb.exe 86 PID 3332 wrote to memory of 3488 3332 jjppp.exe 87 PID 3332 wrote to memory of 3488 3332 jjppp.exe 87 PID 3332 wrote to memory of 3488 3332 jjppp.exe 87 PID 3488 wrote to memory of 2584 3488 lfrxlfl.exe 88 PID 3488 wrote to memory of 2584 3488 lfrxlfl.exe 88 PID 3488 wrote to memory of 2584 3488 lfrxlfl.exe 88 PID 2584 wrote to memory of 920 2584 thnbbh.exe 89 PID 2584 wrote to memory of 920 2584 thnbbh.exe 89 PID 2584 wrote to memory of 920 2584 thnbbh.exe 89 PID 920 wrote to memory of 4268 920 rlllffl.exe 90 PID 920 wrote to memory of 4268 920 rlllffl.exe 90 PID 920 wrote to memory of 4268 920 rlllffl.exe 90 PID 4268 wrote to memory of 1780 4268 xrxrrff.exe 91 PID 4268 wrote to memory of 1780 4268 xrxrrff.exe 91 PID 4268 wrote to memory of 1780 4268 xrxrrff.exe 91 PID 1780 wrote to memory of 3212 1780 pdppp.exe 92 PID 1780 wrote to memory of 3212 1780 pdppp.exe 92 PID 1780 wrote to memory of 3212 1780 pdppp.exe 92 PID 3212 wrote to memory of 4152 3212 frrrxlr.exe 93 PID 3212 wrote to memory of 4152 3212 frrrxlr.exe 93 PID 3212 wrote to memory of 4152 3212 frrrxlr.exe 93 PID 4152 wrote to memory of 2492 4152 jvppp.exe 94 PID 4152 wrote to memory of 2492 4152 jvppp.exe 94 PID 4152 wrote to memory of 2492 4152 jvppp.exe 94 PID 2492 wrote to memory of 4176 2492 rfllrrr.exe 95 PID 2492 wrote to memory of 4176 2492 rfllrrr.exe 95 PID 2492 wrote to memory of 4176 2492 rfllrrr.exe 95 PID 4176 wrote to memory of 4604 4176 httnhh.exe 96 PID 4176 wrote to memory of 4604 4176 httnhh.exe 96 PID 4176 wrote to memory of 4604 4176 httnhh.exe 96 PID 4604 wrote to memory of 4032 4604 bbnbbn.exe 97 PID 4604 wrote to memory of 4032 4604 bbnbbn.exe 97 PID 4604 wrote to memory of 4032 4604 bbnbbn.exe 97 PID 4032 wrote to memory of 3228 4032 ffrxlfx.exe 98 PID 4032 wrote to memory of 3228 4032 ffrxlfx.exe 98 PID 4032 wrote to memory of 3228 4032 ffrxlfx.exe 98 PID 3228 wrote to memory of 1188 3228 ntbnth.exe 99 PID 3228 wrote to memory of 1188 3228 ntbnth.exe 99 PID 3228 wrote to memory of 1188 3228 ntbnth.exe 99 PID 1188 wrote to memory of 3380 1188 pjvvv.exe 100 PID 1188 wrote to memory of 3380 1188 pjvvv.exe 100 PID 1188 wrote to memory of 3380 1188 pjvvv.exe 100 PID 3380 wrote to memory of 3048 3380 flfxrff.exe 101 PID 3380 wrote to memory of 3048 3380 flfxrff.exe 101 PID 3380 wrote to memory of 3048 3380 flfxrff.exe 101 PID 3048 wrote to memory of 2716 3048 jdvjj.exe 102 PID 3048 wrote to memory of 2716 3048 jdvjj.exe 102 PID 3048 wrote to memory of 2716 3048 jdvjj.exe 102 PID 2716 wrote to memory of 4040 2716 pvvjv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe"C:\Users\Admin\AppData\Local\Temp\99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\hhnnnn.exec:\hhnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\hbnbth.exec:\hbnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\lfrrlfx.exec:\lfrrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\hhbtbb.exec:\hhbtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\jjppp.exec:\jjppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\thnbbh.exec:\thnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlllffl.exec:\rlllffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\xrxrrff.exec:\xrxrrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\pdppp.exec:\pdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\frrrxlr.exec:\frrrxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\jvppp.exec:\jvppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\rfllrrr.exec:\rfllrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\httnhh.exec:\httnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\bbnbbn.exec:\bbnbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\ffrxlfx.exec:\ffrxlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\ntbnth.exec:\ntbnth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\pjvvv.exec:\pjvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\flfxrff.exec:\flfxrff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\jdvjj.exec:\jdvjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\pvvjv.exec:\pvvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rrxxxlr.exec:\rrxxxlr.exe23⤵
- Executes dropped EXE
PID:4040 -
\??\c:\tttnnn.exec:\tttnnn.exe24⤵
- Executes dropped EXE
PID:5000 -
\??\c:\llfrlfx.exec:\llfrlfx.exe25⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pvdvp.exec:\pvdvp.exe26⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jddvp.exec:\jddvp.exe27⤵
- Executes dropped EXE
PID:648 -
\??\c:\xflllfl.exec:\xflllfl.exe28⤵
- Executes dropped EXE
PID:5064 -
\??\c:\vppjd.exec:\vppjd.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rlrrrlf.exec:\rlrrrlf.exe30⤵
- Executes dropped EXE
PID:3784 -
\??\c:\1hnhbt.exec:\1hnhbt.exe31⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xfrxflf.exec:\xfrxflf.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vvvpp.exec:\vvvpp.exe33⤵
- Executes dropped EXE
PID:1476 -
\??\c:\dpppp.exec:\dpppp.exe34⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xfffffl.exec:\xfffffl.exe35⤵
- Executes dropped EXE
PID:1008 -
\??\c:\nnbbtb.exec:\nnbbtb.exe36⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rrrxlff.exec:\rrrxlff.exe37⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nnnnnn.exec:\nnnnnn.exe38⤵
- Executes dropped EXE
PID:3644 -
\??\c:\vjdvj.exec:\vjdvj.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xxxlllf.exec:\xxxlllf.exe40⤵
- Executes dropped EXE
PID:3536 -
\??\c:\rrrllll.exec:\rrrllll.exe41⤵
- Executes dropped EXE
PID:3840 -
\??\c:\thtnnn.exec:\thtnnn.exe42⤵
- Executes dropped EXE
PID:3188 -
\??\c:\ddvdd.exec:\ddvdd.exe43⤵
- Executes dropped EXE
PID:3804 -
\??\c:\xflfffx.exec:\xflfffx.exe44⤵
- Executes dropped EXE
PID:3500 -
\??\c:\htbttn.exec:\htbttn.exe45⤵
- Executes dropped EXE
PID:4028 -
\??\c:\7vjdp.exec:\7vjdp.exe46⤵
- Executes dropped EXE
PID:3724 -
\??\c:\rllffff.exec:\rllffff.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhnhnt.exec:\hhnhnt.exe48⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ttnntn.exec:\ttnntn.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lfffxfx.exec:\lfffxfx.exe50⤵
- Executes dropped EXE
PID:632 -
\??\c:\bnttnn.exec:\bnttnn.exe51⤵
- Executes dropped EXE
PID:4528 -
\??\c:\pjjdj.exec:\pjjdj.exe52⤵
- Executes dropped EXE
PID:4532 -
\??\c:\bnbtnn.exec:\bnbtnn.exe53⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:4556 -
\??\c:\vjpjd.exec:\vjpjd.exe55⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ntttnt.exec:\ntttnt.exe57⤵
- Executes dropped EXE
PID:4272 -
\??\c:\dpvpp.exec:\dpvpp.exe58⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llrxlxr.exec:\llrxlxr.exe59⤵
- Executes dropped EXE
PID:4876 -
\??\c:\thnnnn.exec:\thnnnn.exe60⤵
- Executes dropped EXE
PID:3396 -
\??\c:\pdpjd.exec:\pdpjd.exe61⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjjdv.exec:\pjjdv.exe62⤵
- Executes dropped EXE
PID:3488 -
\??\c:\fxrlffl.exec:\fxrlffl.exe63⤵
- Executes dropped EXE
PID:1156 -
\??\c:\5bhbbb.exec:\5bhbbb.exe64⤵
- Executes dropped EXE
PID:4136 -
\??\c:\pddvv.exec:\pddvv.exe65⤵
- Executes dropped EXE
PID:936 -
\??\c:\lrfflll.exec:\lrfflll.exe66⤵PID:216
-
\??\c:\ntnnhn.exec:\ntnnhn.exe67⤵PID:4172
-
\??\c:\ttttbn.exec:\ttttbn.exe68⤵PID:1940
-
\??\c:\lflflrr.exec:\lflflrr.exe69⤵PID:3748
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe70⤵PID:3704
-
\??\c:\5nttnn.exec:\5nttnn.exe71⤵PID:5088
-
\??\c:\ddjdj.exec:\ddjdj.exe72⤵PID:2780
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe73⤵PID:3608
-
\??\c:\nhtnnn.exec:\nhtnnn.exe74⤵PID:2116
-
\??\c:\jvjjd.exec:\jvjjd.exe75⤵PID:3908
-
\??\c:\xfrfrrl.exec:\xfrfrrl.exe76⤵PID:5020
-
\??\c:\7hhnnn.exec:\7hhnnn.exe77⤵PID:4032
-
\??\c:\jjjdv.exec:\jjjdv.exe78⤵PID:3228
-
\??\c:\7llflrr.exec:\7llflrr.exe79⤵PID:2980
-
\??\c:\ttthhn.exec:\ttthhn.exe80⤵PID:1604
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe81⤵PID:1656
-
\??\c:\ntbthn.exec:\ntbthn.exe82⤵PID:3048
-
\??\c:\vvvpd.exec:\vvvpd.exe83⤵
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\xllxffr.exec:\xllxffr.exe84⤵PID:4892
-
\??\c:\frlfrxx.exec:\frlfrxx.exe85⤵PID:4744
-
\??\c:\htbnhh.exec:\htbnhh.exe86⤵PID:4692
-
\??\c:\jjvpj.exec:\jjvpj.exe87⤵PID:3168
-
\??\c:\frfxlxx.exec:\frfxlxx.exe88⤵PID:4700
-
\??\c:\thtntt.exec:\thtntt.exe89⤵PID:5024
-
\??\c:\bhnbth.exec:\bhnbth.exe90⤵
- System Location Discovery: System Language Discovery
PID:5036 -
\??\c:\vpppp.exec:\vpppp.exe91⤵PID:824
-
\??\c:\xfllflf.exec:\xfllflf.exe92⤵PID:5064
-
\??\c:\ttbbtt.exec:\ttbbtt.exe93⤵PID:4652
-
\??\c:\lllfxxr.exec:\lllfxxr.exe94⤵PID:4996
-
\??\c:\1xlxrlr.exec:\1xlxrlr.exe95⤵PID:3784
-
\??\c:\bhbnhh.exec:\bhbnhh.exe96⤵PID:3652
-
\??\c:\jvvdv.exec:\jvvdv.exe97⤵PID:4208
-
\??\c:\lrrxllx.exec:\lrrxllx.exe98⤵PID:4988
-
\??\c:\thnnnn.exec:\thnnnn.exe99⤵PID:1784
-
\??\c:\pppvd.exec:\pppvd.exe100⤵PID:2628
-
\??\c:\lllffff.exec:\lllffff.exe101⤵PID:3900
-
\??\c:\htbtbb.exec:\htbtbb.exe102⤵PID:1144
-
\??\c:\dvvjp.exec:\dvvjp.exe103⤵PID:2924
-
\??\c:\dpdvd.exec:\dpdvd.exe104⤵PID:3988
-
\??\c:\rxffxfx.exec:\rxffxfx.exe105⤵PID:3772
-
\??\c:\ddpdd.exec:\ddpdd.exe106⤵PID:540
-
\??\c:\vvvpj.exec:\vvvpj.exe107⤵PID:1576
-
\??\c:\rrlfffr.exec:\rrlfffr.exe108⤵PID:456
-
\??\c:\5bbbtt.exec:\5bbbtt.exe109⤵PID:4408
-
\??\c:\1vjdj.exec:\1vjdj.exe110⤵PID:4684
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe111⤵
- System Location Discovery: System Language Discovery
PID:4020 -
\??\c:\tnnnhh.exec:\tnnnhh.exe112⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\pjpjd.exec:\pjpjd.exe113⤵PID:3336
-
\??\c:\flrrffl.exec:\flrrffl.exe114⤵PID:636
-
\??\c:\tnnhbt.exec:\tnnhbt.exe115⤵PID:1552
-
\??\c:\7bbtnh.exec:\7bbtnh.exe116⤵PID:4516
-
\??\c:\vppdv.exec:\vppdv.exe117⤵PID:3420
-
\??\c:\rxxxxll.exec:\rxxxxll.exe118⤵PID:4532
-
\??\c:\btbbth.exec:\btbbth.exe119⤵PID:2248
-
\??\c:\dpjvd.exec:\dpjvd.exe120⤵PID:1708
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe121⤵PID:3708
-
\??\c:\nnhbtt.exec:\nnhbtt.exe122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-